plane

plane-mcp-server http mode always builds an OAuth app and crashes without env vars. A 16-line wrapper unlocks header auth with live token checks.

TL;DR: HTTP mode crashed at startup because it always built an OAuth app without env vars. A 16-line wrapper instead calls get_header_mcp() to run a stateless server on loopback 8211 that validates Authorization headers against Plane. This lets local AI agents securely use all 30 tools with no internet exposure or full OAuth setup.

A 13-service Plane stack on a single-admin VPS: a cloudflared sidecar as the only public door, bind-mounted state, and no public host ports.

TL;DR: Running Plane on a packed VPS clashed with its default host ports 80 and 443. I kept the 13-service stack fully internal and exposed it only via a Cloudflare Tunnel sidecar aimed at the proxy, not port 8000 which is just the API. This keeps the firewall to SSH only, handles TLS at the edge, and removes public port exposure.